AND-401Building Security In Maturity Model-BSIMM

1. Bad metrics hurt 2. Secure-by default frameworks 3. Nobody uses WAFs 4. QA can’t do software security 5. Advocacy over audit 6. AA is hard 7. Practitioners don’t talk attacks 8. Training is advanced 9. Pen testing is diminishing 10.Fuzz testing
SDLC Alchemy
CLASP
More Questions than Answers
Same activities for all soft are project? acti ities software How to get budget / internal support? Which l Whi h vulnerabilities d I h biliti do have t fi ? to fix? What about outsourcing? How to handle open source? Who does the work?
Example activity
[T1.3] Establish SSG office hours. The SSG offers help to any and all comers during an advertised lab period or regularly scheduled office h l l h d l d ffi hours. B acting as an By ti informal resource for people who want to solve security problems, the SSG leverages teachable moments and emphasizes th carrot over th stick. Offi h h i the t the ti k Office hours might i ht be held one afternoon per week in the office of a senior SSG member.
Change focus
Old: Integrate into development lifecycle New: Create a software security initiative
6
Breaking new ground
Building Security In Maturity Model (BSIMM) p First empirical data from real initiatives Joint work: Brian Chess, G Ch Gary McGraw, Sammy Migues
Data collection
(Anthropologists unite!)
Big idea: stop hypothesizing, study successful organizations g Create a software security framework In-person executive interviews In person Build bullet lists (one per practice) Bucketize the lists to identify activities Create levels – Objectives Activities – 110 activities supported by real data – Three levels of “maturity”
12
The Software Security Framework (SSF)
Governance Strategy and Metrics Compliance and Policy Intelligence Attack Models Security S it Features and Design Standards and Requirements SSDL Touchpoints Architecture Analysis Code Review Deployment Penetration Testing Software Environment
Technology is cool
Find vulnerabilities* Protect against attack* Harness dev horsepower* Manage vulnerabilities*
* Use only as directed. One part of a healthy security regimen.
Use BSIMM results
BSIMM released March 5 – http://bsi mm com BSIMM i a yardstick is d ti k – Use it to see where you stand – Use it to figure out what should you do next
The nine
( (and two unnamed financial services companies) p )

Real-world data
Age: 5.3 y g yrs
– Newest: 2.5 – Oldest: 10
Satellite size: 79
– Smallest: 0 – Largest: 300 – Median: 20
/articles/article.aspx?p=1315431 http // informit com/articles/article asp ?p 1315431
BSIMM basics
Software security framework Top-down presentation through GOALS and OBJECTIVES 110 activities with examples Three levels of maturity Discussion of how to use the model
p
We hold these truths to be self-evident
Software security is more than security functions Not magic crypto fairy dust Not silver-bullet security mechanisms Non-functional aspects of systems are essential p y Must address both bugs in code and flaws in design Security is an emergent property To end up with secure software, you have to build security in
SSG size: 41
– Smallest: 12 – Largest: 100 – Median: 35
Dev size: 7750
– Smallest: 450 – Largest: 30,000 – Median: 5000
Average SSG size: 1% of dev
Ten surprising things
Configuration Management and Vulnerability Management
Training
Security Testing
/articles/article.aspx?p=1271382
Example: skeleton for training practice
Scorecard (overview)
Common ground
Everyone has a software security group (SSG) SSG is roughly 1% size of dev team Ten activities that ALL do
evangelist role policy awareness training history in training y g security features static analysis SSG does AA black box tools external pen testing p g good network security
/articles/article.aspx?p=1326511
Scorecard (detail)
10 things all do – green = good – red = bad Blue shift practices to emphasize – activities you should think about in blue
The Building Security In Maturity Model M d l (BSIMM)
Brian Chess, Gary McGraw Fortify Software, Cigital Inc 04/24/09 | AND-401 Session Classification: Intermediate
The Building Security In Maturity Model M d l (BSIMM)
Brian Chess, Gary McGraw Fortify Software, Cigital Inc 04/24/09 | AND-401
p